WP Mailster plugin: Unauthenticated arbitrary file upload (web shell)
Summary
The WordPress plugin WP Mailster up to and including version 1.9.1.0 allows arbitrary file uploads. An unauthenticated remote attacker can upload a web shell to the web server and execute code there. Successful exploitation can lead to full takeover of the WordPress site and theft of data. The CVSS base score is 10.0 (CRITICAL), but the NVD analysis is still pending.
Affected
- WP Mailster (WordPress plugin) up to and including 1.9.1.0
- Developer listed as "WP Mailster"; the vendor identity could not be confirmed independently
Fixed in
- Version 1.9.2.0 (patched version according to Patchstack; update to 1.9.2.0 or later)
Workaround
- No vendor-documented workaround known.
- Patchstack reports a virtual patch rule that blocks attacks until the plugin is updated; its coverage could not be verified.
- Blocking PHP execution in upload directories is a general hardening measure, not a vendor recommendation.
Exploitation
- Known exploited: No (per available sources, including HOL and Strix).
- Public proof of concept: none found (VulDB states no exploit is available).
- Patchstack expects exploitation, but this is a forecast and not an observed event.
- Required privilege: none; no user interaction required.
Our recommendation
- Identify all sites running WP Mailster and check their versions.
- Update to version 1.9.2.0 or later immediately.
- If an update is not possible at once, enable a virtual patch or restrict access to the affected endpoints.
- On sites that were vulnerable and exposed, search for unexpected PHP files in upload and plugin directories and review recent access logs.
- Monitor Patchstack and NVD for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-111832 patchstack.com
- WordPress.org plugin page WP Mailster wordpress.org
- VulDB entry 424826 vuldb.com
- OpenCVE CVE-2026-111832 app.opencve.io
- HOL Guard CVE-2026-111832 hol.org
- Strix CVE-2026-111832 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:05.
Original description (NVD)
Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.